The current "winning" opinion is to go with the source+throw away
binaries route. We are close to being able to achieve this, it is
simply that it has not yet been enabled. Before any version of this
can be enabled, buildd autosigning needs to be implemented in order
that dak can differentiate buildd uploads vs maintainer uploads.

It may be necessary to also move the building of contrib packages to the
unofficial non-free buildd network. As it stands any contrib package
which has a non-free Build-Depends is not guaranteed to build on all
architectures since not all the buildd systems include the non-free
archives. Up to now it has been possible to do binary uploads to work
around this and get as many architectures in the archive as possible to
build manually. When this new option is enabled, it will no longer be
possible.

As I understood it, it is still possible for DDs to do binary-only uploads (as
allowed per GR). This throwing away of the binary package is only for the
initial source+binary upload.
(In an ideal world, there should be no need for DDs to do binary-only uploads
by hand, but in reality it has to happen every now and then, at least for
security).

I suppose that is correct. It still makes sense to me that the contrib
packages be built on the non-free autobuilders for practical reasons I
have mentioned above.